The general message I get from your reply is that my only hope is to reformat the laptop.
Your decision as to what action to take should be made by reading and asking yourself the questions presented in the "When should I re-format?
" and "...Now What Do I Do?
" links previously provided. As I already said, with this particular infection, the only sure way to remove it effectively is to reformat
and reinstall the OS or do a factory restore with a vendor-specific Recovery Disk or Recovery Partition
removes everything and is the safest action
but I cannot make that decision for you
If you insist on trying to fix this infection instead of following our advice to reformat and reinstall your operating system, there are some tools and various rescue disks available from major anti-virus vendors which you can try. From what I have read, seen, and tried its virtually impossible to completely remove and just a waste of time. You can try booting from every rescue disk you can find but they will likely leave you computer in an unbootable state in as a result of futile attempts to repair system files and drivers. Even the vendors like Kaspersky say there is no quarantee
that some files will not get corrupted during the disinfection process. In the end most folks end up reformatting out of frustration after spending hours attempting to repair and remove infected files. IMO the safest and easiest thing to do is just reformat and reinstall Windows.Bleeping Computer DOES NOT assume any responsibility for your attempt to repair this infection using any of the following tools. You do this at your own risk and against our advice.
If the computer is bootable, you can try disinfection through a combination of the following tools:
- Dr.Web CureIt.
- Norman Malware Cleaner.
- VIPRE Rescue Program - the size of the downloaded application is large. This is a utility designed to scan and clean a computer which is so badly infected that most programs cannot run. Virus definitions are included and the program is self-running once executed. Be sure to print out and follow the instructions provided on the same page for running under Windows or with the Command Line option from Safe Mode with Command Prompt.
- AVG Win32/Virut Remover. The AVG tool was last updated in August 2008 and is not very effective for the reasons I indicated above.
These are links to Anti-virus vendors that offer free LiveCD or Rescue CD utilities that are used to boot from for repair of unbootable and damaged systems, rescue data, scan the system for virus infections. Burn it as an image to a disk to get a bootable CD. All (except Avira) are in the ISO Image
file format. Avira uses an EXE that has built-in CD burning capability.
If you are not sure how to burn an image, please read How to write a CD/DVD image or ISO
. If you need a FREE utility to burn the ISO image, download and use ImgBurn
.Note: In order to use a rescue disk, the boot order must be set to start from the CD-ROM drive. If the CD is not first in the boot order, the computer will attempt to start normally by booting from the hard drive. The boot order is a setting found in the computer’s BIOS which runs when it is first powered on. This setting controls the order that the BIOS uses to look for a boot device from which to load the operating system. The default will normally be A:, C:, CD-ROM. Different computers have different ways to enter the BIOS. If you're not sure how to do this, refer to:Caution
: If you are considering backing up data and reformatting, keep in mind, with a Virut infection
, there is always a chance of backed up data reinfecting your system. If the data is that important to you, then you can try to salvage some of it but there is no guarantee
so be forewarned that you may have to start over again afterwards if reinfected by attempting to recover your data. Only back up your important documents, personal data files, photos to a CD or DVD drive, not a flash drive or external hard drive as they may become compromised in the process. The safest practice is not to backup
any executable files (*.exe), screensavers (*.scr), autorun (.ini) or script files (.php, .asp, .htm, .html, .xml ) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executable files inside them as some types of malware can penetrate and infect .exe files within compressed files too. Other types of malware may even disguise itself by adding and hiding its extension to the existing file extension as shown here
so be sure you look closely at the full file name. If you cannot see the file extension, you may need to reconfigure Windows to show file name extensions
. Then make sure you scan the backed up data with your anti-virus prior to
to copying it back to your hard drive.
If your CD/DVD drive is unusable, another word of caution if you are considering backing up to an external usb hard drive as your only alternative. External drives are more susceptible to infection and can become compromised in the process of backing up data
. I'm not saying you should not try using such devices but I want to make you aware of all your options and associated risks so you can make an informed decision if its worth that risk.
Again, do not
back up any data with the following file extensions: exe, .scr, .ini, .htm, .html, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.
If you're not sure how to reformat or need help with reformatting, please review:
These links include step-by-step instructions with screenshots:Vista users
can refer to these instructions:
Don't forget you will have to go to Microsoft Update
and apply all Windows security patches after reformatting.Note: If you're using an IBM, Sony, HP, Compaq or Dell machine, you may not have an original XP CD Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. See Technology Advisory Recovery Media. If the recovery partition has become infected, you will need to contact the manufacturer, explain what happened and ask them to send full recovery disks to use instead.
If you need additional assistance with reformatting or partitioning, you can start a new topic in the Operating Systems Subforums forum